EDF ownership and control, and the Article 9(4) derogation
The eligibility test that decides whether a European Defence Fund proposal can be assessed at all: where an entity is established, who controls it, and how the derogation actually works.
Of all the requirements attached to a European Defence Fund proposal, ownership and control is the one most likely to end the conversation rather than complicate it. It is not scored. It decides whether your proposal can be assessed at all.
It is also the requirement most often summarised wrongly, including in material written for applicants. Three of the mistakes below are common enough that you will probably have read at least one of them this month.
Where an entity has to be established
Article 9(1) and 9(2) of the EDF Regulation set the test. A recipient or subcontractor must be established in the Union or in an associated country, and its executive management structures must be established there too.
Both halves matter. The first is a question about registration. The second is a question about where the organisation is actually run, and it exists to catch an entity that is technically a Member State company while its decisions are taken somewhere else.
You will very often see this rendered as "established in the EU". That is not what the Regulation says, and the difference is not academic: as at 8 September 2026 Norway is the only EDF associated country, and a Norwegian entity is eligible provided it also passes the control test below. Establishment is necessary, not sufficient. Call documents express the same rule as a list of eligible countries, which is the practical form to check yourself against, because that list is revised.
What counts as control
The second test, in Article 9(3), is that recipients and subcontractors must not be controlled by a non-associated third country or a non-associated third-country entity.
Article 2(6) defines control as the ability to exercise decisive influence on a legal entity directly, or indirectly through one or more intermediate legal entities. That phrasing does two things. It means a majority shareholding is sufficient but not necessary, and it means an ownership chain does not launder control by adding steps to it.
In practice this is a question about your capital table, your board, your veto rights, your shareholder agreements and anything else that lets somebody outside the Union or an associated country determine what the organisation does. It is worth being honest with yourself early, because a structure that survives a light reading tends not to survive an evaluator's.
This does not shut a non-associated third-country entity out of a project altogether, but the room is narrower than it is usually described. Recipients and subcontractors have to be established in the Union or an associated country. An entity that is not receives no EDF funding, and can be brought in only, exceptionally and on the conditions the call sets, as an associated partner.
The derogation, in Article 9(4)
Control by a non-associated third country is not automatically disqualifying. Article 9(4) provides a route: participation is possible where guarantees are provided. The mechanism is confirmed in the call documents themselves: Annex 2 of the call document is headed "Guarantees pursuant to Article 9(4) of the EDF Regulation".
Three things about it are worth stating precisely, because each is regularly got wrong.
The Member State approves. The Commission assesses.
The guarantee is given and approved by the Member State or associated country where that entity is established. The Commission's role is to assess it. Descriptions that have the Commission granting the derogation have the relationship backwards, and it matters practically: the conversation you need to start is with a national authority, not with Brussels.
The substance of a guarantee is that the entity's involvement would not contravene the security and defence interests of the Union and its Member States. What that looks like in evidence terms varies by Member State.
A guarantee does not travel
This is the detail that surprises people most, and it is the one most likely to cost a bid.
The Commission's guidance "Participation in EU restricted calls with ownership and control restrictions", V2.0 of 1 January 2026, is explicit that guarantees are programme-, call- and project-specific. A guarantee accepted for one project does not carry to the next one. It does not carry from another EU programme. It does not carry from a previous EDF call. The ownership control status underneath it behaves differently: once the Central Validation Service has completed its assessment, that status is normally valid for 36 months from the assessment date, across EU calls. It is the guarantee that has to be obtained afresh, not the assessment behind it.
Note that this is stated in guidance rather than in the Regulation. Article 9(4) is not silent on it: the Article frames both eligibility and the guarantees around "an action" throughout, and the guidance is the Commission articulating what that means across programmes, calls and projects. If you are relying on the rule, cite it accurately.
It is not a form you attach at submission
The assessment is substantive, and it takes time. Because it is call- and project-specific, it cannot be completed in advance as a general matter and then produced when needed. If a derogation is on your critical path, it belongs in your schedule from the first consortium conversation, not in the final fortnight of drafting.
What this means in evidence terms
Read together, these are not statements you make. They are positions you have to be able to demonstrate, at a point in time, possibly long after the fact.
Where is each partner established, and where does its executive management actually sit? Who holds decisive influence, through what chain of intermediate entities, and has that changed during the action? If a guarantee was obtained, for which call and which project, and does the one you are relying on now actually cover this one? Article 9(7) makes a change reportable in its own right: an entity must inform the Commission of anything that might put the eligibility criteria in question, and the Commission then assesses whether they are still met.
That last question is the trap. An organisation that has been through the process once tends to remember that it succeeded and forget the scope of what it obtained. A record that answers "which guarantee, for what, and when" is worth more than a memory of having had one.
This is ordinary requirements traceability applied to corporate structure rather than to a technical specification, and it lives in the same place as everything else you have to evidence: under document control, with an approval history and a date.
Checking this yourself
- Regulation (EU) 2021/697, Articles 2(6), 9(1), 9(2), 9(3), 9(4) and 9(7)
- The Commission's Participation in EU restricted calls with ownership and control restrictions, V2.0, 1 January 2026, for the non-portability of guarantees
- The call fiche for your call, including its annex on Article 9(4) guarantees and its list of eligible countries
We have written up the wider set of obligations in what an EDF grant actually obliges you to prove, and the consortium composition rules are a separate test in Article 10(4), covered in three partners, three Member States, one evidence base.
Ownership, control and guarantees are positions you have to be able to demonstrate on a date, not statements you make once. See how ComplyTrain keeps that evidence current.
This describes what the published rules say as at 8 September 2026. It is not legal advice, and where a requirement turns on the national law of a Member State, that law decides.